To ask the Chancellor of the Duchy of Lancaster whether new guidance on information security has been issued to staff in his Department since 1 October 2007. (180413)

The Cabinet Office takes security very seriously and constantly reviews, and monitors its high level procedures and processes to minimise risks to all its assets.

In December 2007 guidance was issued to staff regarding the implementation of additional procedures being introduced to protect the storage of data on removable media and on the use of laptops and other storage devices.

To ask the Chancellor of the Duchy of Lancaster if the Cabinet Office will collate and publish a list for each Government department, executive agency and non-departmental public body, of which public authorities process personal data in processing centres directly or via contractors outside the European Economic Area. (181312)

The Data Protection Act 1998 includes provisions to ensure that personal data benefits from adequate protection when it is transferred outside the European Economic Area by UK data controllers. Data controllers are responsible for ensuring they comply with the provisions of the Data Protection Act with regard to the transfer of personal data to non-EEA countries. This means that the primary responsibility for putting in place and monitoring appropriate arrangements is on the individual department or other public body that acts as data controller.

Information on which public authorities process personal data in processing centres directly or via contractors outside the European Economic Area is not held by the Cabinet Office.

As part of cross-Government work on data handling, the Government have committed to put in place a programme to tighten procedures for any data stored outside the UK —written ministerial statement of 17 December 2007, Official Report, column 98WS. An update on this commitment will be included in the final report, expected in spring 2008.